/*
* ====================================================================
*
* Licensed to the Apache Software Foundation (ASF) under one or more
* contributor license agreements. See the NOTICE file distributed with
* this work for additional information regarding copyright ownership.
* The ASF licenses this file to You under the Apache License, Version 2.0
* (the "License"); you may not use this file except in compliance with
* the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
* ====================================================================
*
* This software consists of voluntary contributions made by many
* individuals on behalf of the Apache Software Foundation. For more
* information on the Apache Software Foundation, please see
* <http://www.apache.org/>.
*/
package org.apache.ogt.http.impl.client;
import java.io.ByteArrayInputStream;
import java.io.IOException;
import org.apache.ogt.http.HttpEntity;
import org.apache.ogt.http.HttpException;
import org.apache.ogt.http.HttpRequest;
import org.apache.ogt.http.HttpResponse;
import org.apache.ogt.http.HttpStatus;
import org.apache.ogt.http.auth.AuthScope;
import org.apache.ogt.http.auth.Credentials;
import org.apache.ogt.http.auth.UsernamePasswordCredentials;
import org.apache.ogt.http.client.ClientProtocolException;
import org.apache.ogt.http.client.CredentialsProvider;
import org.apache.ogt.http.client.NonRepeatableRequestException;
import org.apache.ogt.http.client.methods.HttpGet;
import org.apache.ogt.http.client.methods.HttpPost;
import org.apache.ogt.http.client.methods.HttpPut;
import org.apache.ogt.http.entity.InputStreamEntity;
import org.apache.ogt.http.entity.StringEntity;
import org.apache.ogt.http.impl.client.BasicCredentialsProvider;
import org.apache.ogt.http.impl.client.DefaultHttpClient;
import org.apache.ogt.http.impl.client.DefaultTargetAuthenticationHandler;
import org.apache.ogt.http.localserver.BasicAuthTokenExtractor;
import org.apache.ogt.http.localserver.BasicServerTestBase;
import org.apache.ogt.http.localserver.LocalTestServer;
import org.apache.ogt.http.localserver.RequestBasicAuth;
import org.apache.ogt.http.localserver.ResponseBasicUnauthorized;
import org.apache.ogt.http.params.CoreProtocolPNames;
import org.apache.ogt.http.protocol.BasicHttpContext;
import org.apache.ogt.http.protocol.BasicHttpProcessor;
import org.apache.ogt.http.protocol.HTTP;
import org.apache.ogt.http.protocol.HttpContext;
import org.apache.ogt.http.protocol.HttpExpectationVerifier;
import org.apache.ogt.http.protocol.HttpRequestHandler;
import org.apache.ogt.http.protocol.ResponseConnControl;
import org.apache.ogt.http.protocol.ResponseContent;
import org.apache.ogt.http.protocol.ResponseDate;
import org.apache.ogt.http.protocol.ResponseServer;
import org.apache.ogt.http.util.EntityUtils;
import org.junit.Assert;
import org.junit.Before;
import org.junit.Test;
/**
* Unit tests for automatic client authentication.
*/
public class TestClientAuthentication extends BasicServerTestBase {
@Before
public void setUp() throws Exception {
BasicHttpProcessor httpproc = new BasicHttpProcessor();
httpproc.addInterceptor(new ResponseDate());
httpproc.addInterceptor(new ResponseServer());
httpproc.addInterceptor(new ResponseContent());
httpproc.addInterceptor(new ResponseConnControl());
httpproc.addInterceptor(new RequestBasicAuth());
httpproc.addInterceptor(new ResponseBasicUnauthorized());
localServer = new LocalTestServer(httpproc, null);
}
static class AuthHandler implements HttpRequestHandler {
public void handle(
final HttpRequest request,
final HttpResponse response,
final HttpContext context) throws HttpException, IOException {
String creds = (String) context.getAttribute("creds");
if (creds == null || !creds.equals("test:test")) {
response.setStatusCode(HttpStatus.SC_UNAUTHORIZED);
} else {
response.setStatusCode(HttpStatus.SC_OK);
StringEntity entity = new StringEntity("success", HTTP.ASCII);
response.setEntity(entity);
}
}
}
static class AuthExpectationVerifier implements HttpExpectationVerifier {
private final BasicAuthTokenExtractor authTokenExtractor;
public AuthExpectationVerifier() {
super();
this.authTokenExtractor = new BasicAuthTokenExtractor();
}
public void verify(
final HttpRequest request,
final HttpResponse response,
final HttpContext context) throws HttpException {
String creds = this.authTokenExtractor.extract(request);
if (creds == null || !creds.equals("test:test")) {
response.setStatusCode(HttpStatus.SC_UNAUTHORIZED);
} else {
response.setStatusCode(HttpStatus.SC_CONTINUE);
}
}
}
static class TestCredentialsProvider implements CredentialsProvider {
private final Credentials creds;
private AuthScope authscope;
TestCredentialsProvider(final Credentials creds) {
super();
this.creds = creds;
}
public void clear() {
}
public Credentials getCredentials(AuthScope authscope) {
this.authscope = authscope;
return this.creds;
}
public void setCredentials(AuthScope authscope, Credentials credentials) {
}
public AuthScope getAuthScope() {
return this.authscope;
}
}
@Test
public void testBasicAuthenticationNoCreds() throws Exception {
localServer.register("*", new AuthHandler());
localServer.start();
TestCredentialsProvider credsProvider = new TestCredentialsProvider(null);
DefaultHttpClient httpclient = new DefaultHttpClient();
httpclient.setCredentialsProvider(credsProvider);
HttpGet httpget = new HttpGet("/");
HttpResponse response = httpclient.execute(getServerHttp(), httpget);
HttpEntity entity = response.getEntity();
Assert.assertEquals(HttpStatus.SC_UNAUTHORIZED, response.getStatusLine().getStatusCode());
Assert.assertNotNull(entity);
EntityUtils.consume(entity);
AuthScope authscope = credsProvider.getAuthScope();
Assert.assertNotNull(authscope);
Assert.assertEquals("test realm", authscope.getRealm());
}
@Test
public void testBasicAuthenticationFailure() throws Exception {
localServer.register("*", new AuthHandler());
localServer.start();
TestCredentialsProvider credsProvider = new TestCredentialsProvider(
new UsernamePasswordCredentials("test", "all-wrong"));
DefaultHttpClient httpclient = new DefaultHttpClient();
httpclient.setCredentialsProvider(credsProvider);
HttpGet httpget = new HttpGet("/");
HttpResponse response = httpclient.execute(getServerHttp(), httpget);
HttpEntity entity = response.getEntity();
Assert.assertEquals(HttpStatus.SC_UNAUTHORIZED, response.getStatusLine().getStatusCode());
Assert.assertNotNull(entity);
EntityUtils.consume(entity);
AuthScope authscope = credsProvider.getAuthScope();
Assert.assertNotNull(authscope);
Assert.assertEquals("test realm", authscope.getRealm());
}
@Test
public void testBasicAuthenticationSuccess() throws Exception {
localServer.register("*", new AuthHandler());
localServer.start();
TestCredentialsProvider credsProvider = new TestCredentialsProvider(
new UsernamePasswordCredentials("test", "test"));
DefaultHttpClient httpclient = new DefaultHttpClient();
httpclient.setCredentialsProvider(credsProvider);
HttpGet httpget = new HttpGet("/");
HttpResponse response = httpclient.execute(getServerHttp(), httpget);
HttpEntity entity = response.getEntity();
Assert.assertEquals(HttpStatus.SC_OK, response.getStatusLine().getStatusCode());
Assert.assertNotNull(entity);
EntityUtils.consume(entity);
AuthScope authscope = credsProvider.getAuthScope();
Assert.assertNotNull(authscope);
Assert.assertEquals("test realm", authscope.getRealm());
}
@Test
public void testBasicAuthenticationSuccessOnNonRepeatablePutExpectContinue() throws Exception {
BasicHttpProcessor httpproc = new BasicHttpProcessor();
httpproc.addInterceptor(new ResponseDate());
httpproc.addInterceptor(new ResponseServer());
httpproc.addInterceptor(new ResponseContent());
httpproc.addInterceptor(new ResponseConnControl());
httpproc.addInterceptor(new RequestBasicAuth());
httpproc.addInterceptor(new ResponseBasicUnauthorized());
localServer = new LocalTestServer(
httpproc, null, null, new AuthExpectationVerifier(), null, null);
localServer.register("*", new AuthHandler());
localServer.start();
TestCredentialsProvider credsProvider = new TestCredentialsProvider(
new UsernamePasswordCredentials("test", "test"));
DefaultHttpClient httpclient = new DefaultHttpClient();
httpclient.setCredentialsProvider(credsProvider);
HttpPut httpput = new HttpPut("/");
httpput.setEntity(new InputStreamEntity(
new ByteArrayInputStream(
new byte[] { 1, 2, 3, 4, 5, 6, 7, 8, 9 } ),
-1));
httpput.getParams().setBooleanParameter(CoreProtocolPNames.USE_EXPECT_CONTINUE, true);
HttpResponse response = httpclient.execute(getServerHttp(), httpput);
HttpEntity entity = response.getEntity();
Assert.assertEquals(HttpStatus.SC_OK, response.getStatusLine().getStatusCode());
Assert.assertNotNull(entity);
}
@Test(expected=ClientProtocolException.class)
public void testBasicAuthenticationFailureOnNonRepeatablePutDontExpectContinue() throws Exception {
localServer.register("*", new AuthHandler());
localServer.start();
TestCredentialsProvider credsProvider = new TestCredentialsProvider(
new UsernamePasswordCredentials("test", "test"));
DefaultHttpClient httpclient = new DefaultHttpClient();
httpclient.setCredentialsProvider(credsProvider);
HttpPut httpput = new HttpPut("/");
httpput.setEntity(new InputStreamEntity(
new ByteArrayInputStream(
new byte[] { 1, 2, 3, 4, 5, 6, 7, 8, 9 } ),
-1));
httpput.getParams().setBooleanParameter(CoreProtocolPNames.USE_EXPECT_CONTINUE, false);
try {
httpclient.execute(getServerHttp(), httpput);
Assert.fail("ClientProtocolException should have been thrown");
} catch (ClientProtocolException ex) {
Throwable cause = ex.getCause();
Assert.assertNotNull(cause);
Assert.assertTrue(cause instanceof NonRepeatableRequestException);
throw ex;
}
}
@Test
public void testBasicAuthenticationSuccessOnRepeatablePost() throws Exception {
localServer.register("*", new AuthHandler());
localServer.start();
TestCredentialsProvider credsProvider = new TestCredentialsProvider(
new UsernamePasswordCredentials("test", "test"));
DefaultHttpClient httpclient = new DefaultHttpClient();
httpclient.setCredentialsProvider(credsProvider);
HttpPost httppost = new HttpPost("/");
httppost.setEntity(new StringEntity("some important stuff", HTTP.ISO_8859_1));
HttpResponse response = httpclient.execute(getServerHttp(), httppost);
HttpEntity entity = response.getEntity();
Assert.assertEquals(HttpStatus.SC_OK, response.getStatusLine().getStatusCode());
Assert.assertNotNull(entity);
EntityUtils.consume(entity);
AuthScope authscope = credsProvider.getAuthScope();
Assert.assertNotNull(authscope);
Assert.assertEquals("test realm", authscope.getRealm());
}
@Test(expected=ClientProtocolException.class)
public void testBasicAuthenticationFailureOnNonRepeatablePost() throws Exception {
localServer.register("*", new AuthHandler());
localServer.start();
TestCredentialsProvider credsProvider = new TestCredentialsProvider(
new UsernamePasswordCredentials("test", "test"));
DefaultHttpClient httpclient = new DefaultHttpClient();
httpclient.setCredentialsProvider(credsProvider);
HttpPost httppost = new HttpPost("/");
httppost.setEntity(new InputStreamEntity(
new ByteArrayInputStream(
new byte[] { 0,1,2,3,4,5,6,7,8,9 }), -1));
try {
httpclient.execute(getServerHttp(), httppost);
Assert.fail("ClientProtocolException should have been thrown");
} catch (ClientProtocolException ex) {
Throwable cause = ex.getCause();
Assert.assertNotNull(cause);
Assert.assertTrue(cause instanceof NonRepeatableRequestException);
throw ex;
}
}
static class TestTargetAuthenticationHandler extends DefaultTargetAuthenticationHandler {
private int count;
public TestTargetAuthenticationHandler() {
super();
this.count = 0;
}
@Override
public boolean isAuthenticationRequested(
final HttpResponse response,
final HttpContext context) {
boolean res = super.isAuthenticationRequested(response, context);
if (res == true) {
synchronized (this) {
this.count++;
}
}
return res;
}
public int getCount() {
synchronized (this) {
return this.count;
}
}
}
@Test
public void testBasicAuthenticationCredentialsCaching() throws Exception {
localServer.register("*", new AuthHandler());
localServer.start();
BasicCredentialsProvider credsProvider = new BasicCredentialsProvider();
credsProvider.setCredentials(AuthScope.ANY,
new UsernamePasswordCredentials("test", "test"));
TestTargetAuthenticationHandler authHandler = new TestTargetAuthenticationHandler();
DefaultHttpClient httpclient = new DefaultHttpClient();
httpclient.setCredentialsProvider(credsProvider);
httpclient.setTargetAuthenticationHandler(authHandler);
HttpContext context = new BasicHttpContext();
HttpGet httpget = new HttpGet("/");
HttpResponse response1 = httpclient.execute(getServerHttp(), httpget, context);
HttpEntity entity1 = response1.getEntity();
Assert.assertEquals(HttpStatus.SC_OK, response1.getStatusLine().getStatusCode());
Assert.assertNotNull(entity1);
EntityUtils.consume(entity1);
HttpResponse response2 = httpclient.execute(getServerHttp(), httpget, context);
HttpEntity entity2 = response1.getEntity();
Assert.assertEquals(HttpStatus.SC_OK, response2.getStatusLine().getStatusCode());
Assert.assertNotNull(entity2);
EntityUtils.consume(entity2);
Assert.assertEquals(1, authHandler.getCount());
}
}